[RonnyB71]

Adds docs/adr/ for architecture decision records (ADRs): one file per technical decision, with its context, the options considered, the decision and its consequences. docs/specification/decisions.md keeps logging why requirements change. An ADR records how we build something.

Contents

• docs/adr/README.md: when to write a record, how (Proposed in a PR → Accepted or Rejected → implemented in its own PR), an index, and a template based on Michael Nygard's format plus an «Options» section.
• ADR-0001: Login and sessions, status Accepted. It's written afterwards from Require login for all of Saman in the specification #21 and Require login with Entra ID or a password for all of Saman #23.
  • Payload owns the session, and the OpenID Connect flow runs in the CMS.
  • Users are identified by Entra ID's oid.
  • Astro checks every request and reads as the visitor, with Authorization: JWT.
  • It also covers the alternatives we didn't choose and what follows, such as the Saman session being separate from the Microsoft session.
• ADR-0002: Password login only for break-glass accounts, status Proposed. Please discuss it here, as review comments. It asks who should be able to use the password login (NF-12): (a) a few named break-glass accounts, or (b) everyone with a password. It proposes (a), and lists what still has to be agreed.
• CLAUDE.md points to docs/adr/. It says accepted records are followed, proposed records are not built, and when to write a new one.
• README.md: the «Login» section links to ADR-0001.

Requirements: NF-02, NF-11, NF-12, NF-13. No specification changes. If ADR-0002 is accepted, NF-12 gets sharper wording in its own PR, with an entry in decisions.md.

The repository is public, so ADR-0002 describes the design and the trade-offs, but not how to exploit the current setup.

Outside this PR: docs/diagrams/architecture.md is out of date. It still says Entra ID sign-in is "decided but not built yet", and its diagram shows the OpenID Connect flow going to the frontend's pages, while ADR-0001 runs it in the CMS. I haven't touched it, since the SVG is drawn by hand from the Mermaid source.

🤖 Generated with Claude Code